WP Manifestindependent plugin directory
manifest / media / videojs-player-wp-plugin

Videojs HTML5 Player 2 WP RegistryHigh-severity findings · 1 findingOpen the reportC-

VideoJS-Player-Plugin for wordpress

by Hushino · github.com/hushino/videojs-player-wp-plugin · website

★ 2stars
27release downloads
≈10active sites
v7.5.0latest · 7 years ago

Install

Download videojs-html5-player.zip From the v7.5.0 release on GitHub, Mar 13, 2019

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hushino/videojs-player-wp-plugin/releases/download/v7.5.0/videojs-html5-player.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/hushino/videojs-player-wp-plugin ↗

Videojs HTML5 Player

Embed video file beautifully in WordPress using Videojs HTML5 Player. Embed HTML5 compatible responsive video in your post/page with video js.

Description

This plugin using last version of videojs player https://github.com/videojs/Video.js/releases Videojs HTML5 Player.

Videojs HTML5 Player is a user-friendly plugin that supports video playback on desktops and mobile devices. It makes super easy for you to embed both self-hosted video files or video files that are externally hosted using Videojs library.

https://www.youtube.com/watch?v=uF-V6qGvcu8&rel=0

Requirements

Videojs HTML5 Player Features

  • Embed MP4 video files into a post/page or anywhere on your WordPress site
  • Embed responsive videos for a better user experience while viewing from a mobile device
  • Embed HTML5 videos which are compatible with all major browsers
  • Embed videos with poster images
  • Embed videos using videojs player
  • Automatically play a video when the page is rendered
  • Embed videos uploaded to your WordPress media library using direct links in the shortcode
  • No setup required, simply install and start embedding videos
  • Lightweight and compatible with the latest version of WordPress
  • Clean and sleek player with no watermark
  • fallbacks for other HTML5-supported filetypes (WebM, Ogv)

Videojs HTML5 Player Plugin Usage

In order to embed a video create a new post/page and use the following shortcode:

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4"]

Here, "url" is the location of the MP4 video source file (H.264 encoded). You need to replace the sample URL with the actual URL of the video file.

Video Shortcode Options

The following options are supported in the shortcode.

WebM

You can specify a WebM video file in addition to the source MP4 video file. This parameter is optional.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" webm="http://example.com/wp-content/uploads/videos/myvid.webm"]

Ogv

You can specify a Ogv video file in addition to the source MP4 & WebM video files. This parameter is optional.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" webm="http://example.com/wp-content/uploads/videos/myvid.webm" ogv="http://example.com/wp-content/uploads/videos/myvid.ogv"]

Width

Defines the width of the video file (Height is automatically calculated). This option is not required unless you want to limit the maximum width of the video.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" width="480"]

Preload

Specifies if and how the video should be loaded when the page loads. Defaults to "auto" (the video should be loaded entirely when the page loads). Other options:

  • "metadata" - only metadata should be loaded when the page loads
  • "none" - the video should not be loaded when the page loads

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" preload="metadata"]

Controls

Specifies that video controls should be displayed. Defaults to "true". In order to hide controls set this parameter to "false".

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" controls="false"]

When you disable controls users will not be able to interact with your videos. So It is recommended that you enable autoplay for a video with no controls.

Autoplay

Causes the video file to automatically play when the page loads.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" autoplay="true"]

Poster

Defines image to show as placeholder before the video plays.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" poster="http://example.com/wp-content/uploads/poster.jpg"]

Loop

Causes the video file to loop to beginning when finished and automatically continue playing.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" loop="true"]

Muted

Specifies that the audio output of the video should be muted.

[videojs_video url="http://example.com/wp-content/uploads/videos/myvid.mp4" muted="true"]

For detailed documentation please visit the Videojs HTML5 Player plugin page

Installation

  1. Go to the Add New plugins screen in your WordPress Dashboard
  2. Click the upload tab
  3. Browse for the plugin file (videojs-html5-player-2.zip) on your computer
  4. Click "Install Now" and then hit the activate button

Frequently Asked Questions

Can this plugin be used to embed videos in WordPress?

Yes.

Are the videos embedded by this plugin playable on iOS devices?

Yes.

Can I embed responsive videos using this plugin?

Yes.

Screenshots

  1. Videojs Player Demo

Upgrade Notice

none

Changelog

2.0.0

  • Videojs update to v7.5.0

1.1.3

  • Videojs play button is now centered by default.

1.1.2

  • Videojs HTML5 Player is now compatible with WordPress 4.9.

1.1.1

  • Added support for playsinline attribute which allows a video to play inline on iOS (the video will not automatically enter fullscreen mode when playback begins).

1.1.0

  • Videojs script is now enqueued in the footer to avoid a JavaScript setup error.

1.0.9

  • Made jQuery a dependency for the videojs script.

1.0.8

  • Updated the translation files so the plugin can take advantage of language packs.
  • Videojs HTML5 Player is now compatible with WordPress 4.4.

1.0.7

  • Added a new shortcode parameter to accept Ogv as a video source format.

1.0.6

  • Added a new shortcode parameter to accept WebM as a video source format.

1.0.5

  • Updated the Videojs library to 5.0.0

1.0.4

  • Videojs HTML5 Player is now compatible with WordPress 4.3

1.0.3

  • Added an option to mute the audio output of a video
  • Added an option to loop a video

1.0.2

  • Added an option to show/hide controls
  • Added an option to set preload attribute

1.0.1

  • First commit

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v7.5.0 latest
Mar 13, 2019 7 years ago
videojs-html5-player.zip
17
v1.9.0
Aug 31, 2017 9 years ago
videojs-player.zip
10

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Videojs HTML5 Player 2 2.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.0
Findings
1
Worst severity
high
Content hash
70c44ca24e79b8cb4d8785c9…

Findings

  • high Contributor+ stored XSS via unsanitized [videojs_video] shortcode attributes

    xss_stored

    videojs_html5_video_embed_handler() extract()s shortcode_atts for url, webm, ogv, poster, and width and interpolates them raw into HTML. $url/$webm/$ogv become <source src="…">, $poster becomes a poster="…" attribute on <video>, and $width is dropped into a heredoc <style> rule as max-width:{$width}px. There is no sanitize_text_field, esc_url, esc_attr, or absint. WordPress kses for Contributor/Author (no unfiltered_html) strips raw <script> from post_content but does not parse shortcode attributes, so [videojs_video url='http://x.example/x.mp4" onerror=alert(document.domain) x="'] or [videojs_video url="http://x.example/x.mp4" width='1} </style><script>alert(document.domain)</script><style>x{x:1'] persist. On render, do_shortcode (the_content, plus this plugin's extra the_excerpt and widget_text filters) returns that markup into the page. The width payload injects a real <script> element; the url/poster payloads break out of quoted attributes onto <source>/<video> event handlers. Both execute in the site origin for every visitor of an Author-published post and for an administrator who previews a Contributor pending post. Public PoC for the wp.org ancestor is [videojs_video url='" onerror=alert(/XSS/) "'] (CVE-2022-3985 / WPScan 58f82e13; CVE-2024-5205 for leftover attributes through 1.1.11). Upstream 1.1.12 maps atts through sanitize_text_field and wraps URLs in esc_url; this GitHub 2.0.0 release (Video.js 7.5.0, tested up to 5.1.1) never applied that patch. embargoed false: advisories are already public.

    videojs-html5-player.php:104-195

    Recommendation

    Sanitize every shortcode attribute (array_map('sanitize_text_field', $atts) after shortcode_atts). Echo URLs with esc_url(), the player id with esc_attr(), and width with absint() (or reject non-numeric width). Do not concatenate untrusted strings into HTML or CSS. Align this fork with wp.org videojs-html5-player 1.1.12+ or switch sites to that patched plugin.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →